Azure Active Directory Developer Support Team

We have a new home

bac hoang — Wed, 02 Jan 2019 15:47:42 GMT

Hi everyone, We are migrating the content of the blog site over to http://blogs.aaddevsup.xyz/. Please book mark this new link.

Receiving Error AADSTS50058 in JavaScript Setting

Frank Hu MSFT — Wed, 07 Nov 2018 20:47:30 GMT

Introduction

This post is to review why a user may receive the error AADSTS50058 in a Javascript setting. The full error that is shown is : AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com). We will review why this issue may occur and some possible resolutions to prevent this error from occurring again.

Reason for AADSTS50058

The reason that the error occurs is because a silent sign in is sent to the login.microsoftonline.com endpoint, however the AADSSO cookie isn't being detected. This cookie determines if the user is logged in or not. The silent sign in is only meant to be used if the user is already known to be logged in or has a refresh token to exchange for a new access token. By checking the KMSI box the first time logging in, this will add the KMSI cookie to let you refresh your access token so that users won't receive this error for a longer period of time.

Possible Resolution #1 Proactively Check for Expiration

You can attempt to prevent this error from ever occurring by checking if you have a valid id token. If you're ID token is not valid, you will ask the user to login again. You can check if the ID Token is valid by getting the token using AuthenticationContext.getCachedToken(clientID) and then checking the Expiration in the JWT Token.

Possible Resolution #2 Catching the Error and Asking the User to Login Again

To resolve this error you will need to catch this error in a callback that you can pass into the acquiretoken ADAL JS function. If the AADSTS50058 error occurs, you'll ask the user to login again.

Possible Resolution #3 Browser Extension Cookie Blockers and Third Party Cookies Disabled

Some users may experience this issue due to a browser extension that is blocking cookies for tracking purposes. This will cause this AADSTS50058 error to occur, you will need to whitelist the login.microsoftonline.com endpoint in your browser extension in order to avoid receiving this error again. This error can also occur if the third party cookies have been disabled in your browser. Re-enable third party cookies in your browser to prevent this error from occurring.

Conclusion

In this post we reviewed three possible resolutions to fix this error. If you are still experiencing this error after attempting all three resolutions please file a support ticket with Azure Support and file an issue on the ADAL github library that you are using. The github issue section for the ADAL JS library can be found here : https://github.com/AzureAD/azure-activedirectory-library-for-js/issues

How to Use the .Net Microsoft Graph SDK to Get Users and Get Next Page of Results

Frank Hu MSFT — Wed, 07 Nov 2018 20:47:04 GMT

Introduction

This post will explain how to use the .Net Microsoft Graph SDK in order to get users. This article is assuming that you have already gotten an Access Token using ADAL .NET. In order to learn more on how to get the Adal .NET token, please reference :

How to Use the ADAL .NET library to Acquire a Token Interactively in a Console Application (Authorization Code Flow) Link

Warning Regarding Microsoft Graph SDK

The Microsoft Graph SDK isn't updated as frequently as the Microsoft Graph API, which makes the Microsoft Graph SDK lag behind a bit. The most effective way to keep up with the Microsoft Graph API is to utilize the HTTPClient, and then parse the response body accordingly. If you would like to utilize the data structures and requests predefined in the Microsoft Graph SDK that is fine, however know that the SDK will not always be up to date with the Microsoft Graph API.

Installing the MSFT Graph SDK NuGet

In order to install this SDK, please go to your project management and then go to browse. Then look up Microsoft.Graph. This NuGet Package is shown in the picture below. It is the Microsoft.Graph library.

Making Calls Using the Microsoft Graph SDK

In order to make calls to the Microsoft Graph SDK, you will need to get the Access token as shown in the other post on utilizing ADAL .net library to acquire a token. Once the access token has been acquired, you will create the graphserviceclient, setting the header of the request message as the access token. This is shown in the github gist below. In the example, we get use the object in the graphserviceclient Users, which has a request call, which has the HTTP request call within, which can be called by awaiting the .getAsync(); method chain. In order to set the OData parameters, you can add them after the request() call. Expand, Skip, Top, OrderBy, and Filter are also supported via the client library when supported by the Microsoft Graph service for the request type. For more information, please refer to the documentation for the MSFT Graph SDK here: https://github.com/microsoftgraph/msgraph-sdk-dotnet/blob/dev/docs/overview.md In order to page through the results, you will have to utilize the call : await users.NextPageRequest.GetAsync(); Where users is the GraphServiceClient Result.

Conclusion

This post has gone over how to install and utilize the Microsoft Graph SDK in order to get users from the Microsoft Graph API. We also review how to page through the Microsoft Graph SDK users in order to get the next set of users accordingly. If you have any issues with the Microsoft Graph SDK, please file an issue with them and the maintainers of the SDK will work to resolve the issue. https://github.com/microsoftgraph/msgraph-sdk-dotnet/issues

If you have any issues with Azure Active Directory and making the Microsoft Graph API call, please file a support ticket with Azure and we will get back to you as soon as possible to resolve the issue.

How to Use the ADAL .NET library to Call the Microsoft Graph API in a Console Application (Using Authorization Code Flow)

Frank Hu MSFT — Wed, 07 Nov 2018 20:46:29 GMT

Introduction

This post is to show how to use the ADAL .NET library to acquire a token interactively in a console application. It will go through setting up an Azure Active Directory Application, setting up the .net console application, acquiring an access token, and then make a HTTP request using the token acquired from the ADAL .net library to get 5 users using the Microsoft Graph API.

Setting up your Azure Active Directory Application Registration

First we will need to setup an Azure Active Directory Application Registration in your Azure Portal. You can do this by going to the Azure Portal > Azure Active Directory > App Registrations > Add Application. Then set the Application Registration to a native app, and put in your own respective values for redirect url and name. The redirect URL will not matter, it will only be important to remember for when you are asking for an access token, and the name is up to you.

Note: It is important to make it a Native Application, otherwise you will get errors saying that there is no Client Secret

After you have created the Application, keep track of the Application ID for later. You will need it to authenticate with this AAD Application Registration, then go to required permissions >Add > select an API > Microsoft Graph API > select view users' basic profile > and press grant permissions. For more information on which permissions you need and how to grant permissions in different ways, please refer to these posts : https://blogs.msdn.microsoft.com/aaddevsup/2018/05/21/finding-the-correct-permissions-for-a-microsoft-or-azure-active-directory-graph-call/ https://blogs.msdn.microsoft.com/aaddevsup/2018/05/08/receiving-aadsts90094-the-grant-requires-admin-permission/

Setting up the console application

To start, let's create a new project, install the correct NuGet packages, and fix reference assembly issues. In this tutorial I will be using a new project with the template Console App (.net framework). Now that we have a fresh new console .net application, we will need to install some libraries in order to get an access token from Azure Active Directory. The ADAL libraries are Microsoft maintained libraries that we will need to get for our .net console application. We can do this by going to our NuGet Manager and picking up the correct libraries. In order to do this you will want to right click on the solution, and go to Manage NuGet Packages for Solution. In this example we will be using the NuGet pacakages below. You can search and then download them via the Browse section of the NuGet Manager. Id Versions -- -------- Microsoft.IdentityModel.Clients.ActiveDirectory {4.3.0} Microsoft.IdentityModel.JsonWebTokens {5.3.0} Microsoft.IdentityModel.Logging {5.3.0} Microsoft.IdentityModel.Tokens {5.3.0} Newtonsoft.Json {11.0.2} System.IdentityModel.Tokens.Jwt {5.3.0} The ADAL libraries are the Microsoft.IdentityModel libraries, however the other two libraries are being used for formatting JWT tokens and JSON tokens to be a readable print. This is to make our lives easier later on once we get the access token and JSON response. After you have installed all the NuGet libraries, you may still need to fix a reference assembly for System.Web.Script.Serialization. In order to do this, right click on the references in the solution explorer and then click add reference. We will then want to add the System.Web.Extensions, as shown in the picture below.

Variable Initialization

Now that we have all the correct libraries and references installed into our solution, you will want to declare some variables for your AAD token acquisition. You'll need to declare the variables listed below. In this example we will be accessing the Microsoft Graph API, so the resource URI has already been declared. You will need to replace the client id(Application ID), redirect URI, and tenant id with your own respective information. You can get the tenant ID from your Azure Active Directory portal in the overview section. You will need to get the client id and redirect URI from the first steps that we followed when creating the AAD Application. After you have initialized the variables we can setup our main method with some empty methods. I have setup my main method as below. First we will get our access token, and then make the call to the Microsoft Graph with the access token to retrieve 5 users. Once we have the variables declared and our main skeleton method setup, we can start on our Access Token Call method, shown below. First we initialize the authcontext which is the variable that maintains the environment for the ADAL library. In this setup we try to acquire the access token three times if it fails. Once you have initialized the authcontext, you can simply make the call : authContext.AcquireTokenAsync(resourceUri, clientId, new Uri(redirectUri), new PlatformParameters(PromptBehavior.Auto)); Which will get the access token. In this method we also pretty print the JWT token, so that you can read the claims in the console. The pretty print method can be found here : That defines the getAccessToken() method. Now, we will need to flesh out the getMembers() method. This method can be seen below, first we add the access token we just got to the headers of the HTTP client, then we make the Microsoft graph call using a getAsync method call from the HTTP client class. The documentation on the Microsoft Graph list users call can be read here : https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/user_list In addition to getting the users, we have set the OData V4 $top requirement, in order to get only the first 5 users. In order to continue getting the next 5 users, you can utilize the skip token that is sent back in the response body. More documentation on this can be found here : https://developer.microsoft.com/en-us/graph/docs/overview/query_parameters https://developer.microsoft.com/en-us/graph/docs/concepts/paging After getting the JSON response, we utilize the prettify JSON method in order to clean up and easily print out the JSON response. Now we can run our console application, and we will get 5 users from the Microsoft Graph API.

Note: The account you login with will need the permissions to read all basic user profiles in order to properly call the Microsoft Graph API call as this is an on behalf of the user flow.

Conclusion

After going through all of this we have setup an AAD App registration that we can connect to using ADAL .NET. We have filled out the code to acquire an access token using ADAL and then make a HTTP request using the HTTP Client to get 5 users from the Microsoft Graph API. If you have any issues with the code, feel free to open up a GitHub issue on the repository to address any coding issues. If you are having an issues with AAD Access, please open up a support ticket and one of our support engineers will reach out as soon as possible. The full GitHub Repository of this code can be found here : https://github.com/frankhu1234/ADAL-.NET-Console-Application

Unable to Delete Azure Active Directory Application Registration

Frank Hu MSFT — Wed, 31 Oct 2018 19:56:30 GMT

Introduction

This post is meant to go over the issue when the Azure Active Directory Application Registration delete button is grayed out. This issue could occur for a few reasons, and this document will go over the current known issues with Azure Active Directory Portal issues. This post will mainly go over the issues detailed in the v1.0 endpoint (portal.azure.com).

Context

Some users will find that they have many Azure Active Directory Application Registrations and will want to clean up the list of Registrations, which makes the user want to delete a few. They will run into not being able to delete the Application as the button is grayed out like in the picture below.

Resolution

The reason that you are unable to delete the AAD Application Registration is because of some properties in the AAD Application Registration or your account doesn't have the right permissions. I will first go over the properties for the possible issues with the AAD Application Registration.

AAD Application Registration Property Issues for Web App/APIs

If the AAD Application Registration has the multi-tenanted value checked, then the Application will not be able to be deleted. In order to resolve this issue please follow the highlighted steps in the picture below. Go to your AAD Application Registration, then go to Settings > Properties > Multi-Tenanted - Set to No. Then after saving and backing out of the Application Registration, go back into the registration and you will be able to delete the AAD Application Registration.

AAD Application Registration Property Issues for Native Applications

For users who have AAD Application Registrations that are registered as "Native" Applications, you will have to go into the manifest in order to remove the multi-tenanted setting. This can be found by following the steps in the picture below. Go to your AAD Application Registration, click on Manifest, and then set the availabletoothertenants value to false. Save the manifest and then go back in to the Azure Active Directory Application Registration, and you will be able to delete the Application Registration.

User Role Issues

Some Users will be unable to delete an Azure Active Directory Application Registration because they do not have the correct roles to delete the Application Registration. The roles can be found here : https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles That being said, the roles that have the action : microsoft.aad.directory/applications/delete listed in the "Actions" section are the roles that have the privilege to delete AAD Application Registrations in their respective tenant. Currently as of 10-25-2018, the only two roles that have this are the Application Administrator and Cloud Application Administrator. Note: You can also set a Service Principal to have an admin role following the guide here : https://blogs.msdn.microsoft.com/aaddevsup/2018/08/29/how-to-add-an-azure-ad-role-to-a-enterprise-application-service-principal/ if you are interested in deleting AAD Applications using a service principal.

Deleting Azure AD Application Using Powershell

You can also utilize Powershell in order to delete an AAD Application Registration. You will need to get the ObjectID from the AAD portal, or use powershell cmdlets to get the AAD Application ID. This link describes how to install the AAD V2.0 powershell in more detail : https://docs.microsoft.com/en-us/powershell/azure/active-directory/install-adv2?view=azureadps-2.0 First you will need to open up powershell in administrator mode. Then you will need to install the AzureAD Module, as shown below. If nothing shows up, you may have to press enter again to see the get provider prompt. Enter the letter Y or A on each prompt. Each prompt may require you to press enter again. After agreeing to install the item, you will need to connect to Azure using connect-azureAD. Be sure to login to the correct tenant (best to use organization account) that has the application you are trying to delete. more about Connect-AzureAD can be found here : https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0 Now go to the portal and get the object ID of the Azure AD Application Registration you are trying to delete, this can be shown in the picture below. I've highlighted the objectID and the multi-tenanted property to show this will work for apps that cannot be deleted in the portal. You can also use the cmdlet : get-azureadapplication, more on this is listed here :https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadapplication?view=azureadps-2.0 Then You will be able to delete the AzureAD application using the Remove-AzureADApplication powershell cmdlet. More on the Remove-AzureADApplication cmdlet can be found here : https://docs.microsoft.com/en-us/powershell/module/azuread/remove-azureadapplication?view=azureadps-2.0 For more information on the AAD V2.0 powershell cmdlets, please refer to the reference : https://docs.microsoft.com/en-us/powershell/module/azuread/?view=azureadps-2.0

Conclusion

In this post we have gone over a few reasons why you may not be able to delete some or any Azure Active Directory Application Registrations. We went over the different property settings and the user roles that have the rights to delete an Application Registration. If you have anymore issues, feel free to open a support ticket or comment below and one of our support engineers will reach out to you as soon as possible to resolve the issue.

Unable to Modify User Email, Phone Number, Password or Other Personal Information for Azure Active Directory Users

Frank Hu MSFT — Wed, 17 Oct 2018 21:51:26 GMT

Introduction

This post is in regards to the issues in regards to users having issues modifying Azure Active Directory User attributes such as mail, phone number, resetting passwords, or other personal attributes in user accounts. This will review the reason behind these changes and how to resolve the issue. For many users this was something that was working before and only recently stopped working properly.

Reason Behind Change

There was a recent change to three different attributes that made changing the attributes require the same elevated privileges that password reset requires. The only properties that are being affected are the attributes : mobilePhone, businessPhones/telephoneNumber, and otherMails attributes. User profile changes can be made with User.ReadWrite.All except for the 3 aforementioned properties.

Fix/Resolution

In order to resolve this issue you will need to set the Service Principal or User that is trying to make the change to a Helpdesk Admins, User Account Admins and Company Admins depending on the user you are trying to modifies role is. Only these three admins can make changes to these three attributes in Azure Active Directory now.

Please note the level of power you are giving the service principal by setting the service principal or user to one of the aforementioned roles, realize that you are giving the user/service principal the ability to perform tasks at that level. This should be done with caution.

Microsoft Graph Scenario

Most users experiencing this issue are Microsoft Graph or Azure Active Directory users that are utilizing the Grant Type Client Credentials in order to make modifications to the three mentioned User Attributes. Having the Directory.readwrite.all permission is now not sufficient to make modifications to these user attributes anymore. You will get a 403 error saying insufficient permissions. In order to resolve this issue you can set the Service Principal/Enterprise Application as one of the admin roles in the resolution stated in the last paragraph. For help on giving a Service Principal an Admin Role please go through this post : https://blogs.msdn.microsoft.com/aaddevsup/2018/08/29/how-to-add-an-azure-ad-role-to-a-enterprise-application-service-principal/

Conclusion

Here we have gone over the User Attribute change's reasoning, how to resolve the issue, the Microsoft/AAD Graph Scenario, and a link explaining how to give a Service Principal/Enterprise Application an Admin role. If you have anymore questions in regards to this issue, feel free to comment below on this issue and I will try to get back to you as soon as possible. If you have any dire issues feel free to open a support ticket for Azure Active Directory Developer, and one of our support engineers will reach out to you to resolve the issue as soon as possible.

How to filter Fiddler capture traffic using host name and process name

bac hoang — Wed, 26 Sep 2018 19:46:49 GMT

This post discusses a couple of ways to filter Fiddler traffic based on domain names (or host names) and client process(es): Note that before using filter you should make sure Fiddler is configured to capture all processes. This is indicated at the bottom left corner of Fiddler window. That area is clickable to change the selection.

Filter traffic using Fiddler’s built-in filter feature:

From Fiddler’s right pane –> Filters tab –> select “Use filters” –> under the Hosts section choose “Show only the following Hosts” –> Enter the host names you want to filter on, separated by semicolon Note: as you edit this list the text box will change to have the yellow background to indicate the list is unsaved. Once done, you can just click on the “Actions” button to save the list and the background color should change to white. Under the “Client Process” section, you can also select a particular process to filter on. This option is great for a standalone application. It may not be so useful for capturing browser traffic since there are multiple processes with the same name and it’s hard to tell which process is the right one to filter on.

Filter traffic using jscript code in the OnBeforeRequest function:

This option can be used especially for browser scenarios. From Fiddler’s menu –> Rules –> “Customize Rules…” -> find the “OnBeforeRequest” function and insert the below jscript code at the beginning of the function –> Make sure to save the changes once done editting.

[sourcecode language="javascript" padlinenumbers="true"] // begin filter // set this to false to disable filter and true to enable filter var filterOn: boolean = true; if (filterOn) { // hide all request by default oSession["ui-hide"] = "true"; // here are some common processes: IE - iexplore.exe; chrome - chrome.exe, MS Edge = MicrosoftEdgeCP.exe, IIS Express - iisexpress.exe, Powershell - powershell.exe // list of domain names to filter on var host = ["localhost","login.microsoftonline.com","graph.microsoft.com"]; // list of processes to filter on var processlist = ["chrome","microsoftedgecp","iisexpress","powershell"]; for (var j = 0;j < processlist.length;j++) { if (oSession.LocalProcess.Contains(processlist[j])){ for (var i = 0;i < host.length; i++) { if(oSession.HostnameIs(host[i])) { oSession["ui-hide"] = null; } } } } } // end filter [/sourcecode]

variables:

filterOn: true to enabe filter and false to disable filter host: contains the list of domains to filter on processlist: contains the list of process names to filter on

References:

Modifying a Request or Response FiddlerScript CookBook Understanding FiddlerScript

Capture http(s) traffic with Http Fiddler

bac hoang — Wed, 12 Sep 2018 05:32:49 GMT

1 - Download the Fiddler 4 application and install it on the machine used to reproduce the problem (if you have not already). Go to http://www.telerik.com/download/fiddler 2 - Enable the option to decrypt HTTPS traffic: Tools -> Options -> Https -> select ‘decrypt HTTPS Traffic’ (you may be prompted to install the Fiddler certificate - make sure to select Yes) Ensure this option is checked when collecting the trace as the data will have to be recollected if it is not. 3 - Restart the Fiddler program (For browser-based apps) 4a. Either use private browsing mode or clear the client browser cache on the machine you will be testing from (many files are downloaded once by the browser and then cached and so will be missing from the trace unless the cache is clear; we need to see javascript and stylesheet files etc. to look for rewrite errors). (For non browser-based apps) 4b. Launch your client application 5 – Reproduce the problem and you should see https traffic showing up in the Fiddler window. 6 - Save the resulting session output as SAZ files (File -> Save -> All Sessions)

How to Add an Azure AD Role to a Enterprise Application (Service Principal)

Frank Hu MSFT — Wed, 29 Aug 2018 21:23:43 GMT

Introduction

This post is to help users be able to assign administrative roles to Enterprise Applications/Service Principals so that they can perform duties that would otherwise require a user with elevated permissions to accomplish. This is convenient when a user wishes to use a service principal in order to reset a password, or to perform some activity that requires admin privileges programmatically without an interactive sign in (using client credentials grant type flow). In this post we will go over installing MSOnline (MSOL) PowerShell module, finding the Object ID for your Enterprise Application, and then giving the Enterprise Application an administrative role.

Note: We will be using MSOnline powershell cmdlets, these are a bit outdated. So as of 8-29-2018 they have not been deprecated yet, however please be sure to check the status of MSOL library. The history for the AAD libraries can be found here: https://social.technet.microsoft.com/wiki/contents/articles/28552.microsoft-azure-active-directory-powershell-module-version-release-history.aspx We will be using Version 1.1.166.0 (PowerShell V1 General Availability) You can also utilize AAD powershell V2.0. We will be going over this as well.

Prerequisite

In order to add an Application role to a Service Principal, you will need to have the proper permissions to assign roles to objects. Per the documentation here : https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#details-about-the-global-administrator-role You will need to be a Global Administrator in order to set the roles to the Enterprise Application. Please be sure to get the global admin to perform to set the Enterprise Application to have the administrative privilege.

Getting Started with MSOL

In order to add the application role to a service principal we will have to utilize the older MSOL powershell Cmdlets. In order to install MSOL, open up PowerShell and type in : Install-Module -Name MSOnline You can find the library in the PowerShell gallery here : https://www.powershellgallery.com/packages/MSOnline/1.1.183.17 After you have installed MSOL, you will need to login to your Azure Active Directory using MSOL. In order to do this use the command : Connect-MsolService There should now be a popup asking you to login to Azure. Be sure to use a global admin account, otherwise you won’t be able to follow the next step to give an enterprise application an administrative role.

Getting Started with AAD PowerShell V2.0

This document goes over install AAD Powershell V2.0: https://docs.microsoft.com/en-us/powershell/azure/active-directory/install-adv2?view=azureadps-2.0 Similar to installing MSOL. You will utilize the commands : Install-Module AzureAD Connect-AzureAD

Getting the ObjectID of the Enterprise Application

Now we need to get the Object ID from the Enterprise Application. There are two ways you can do this, you can get the Object ID from the powershell CMDlet, or you can go to the Azure Portal and get the object ID from the Enterprise Application under the properties blade.

Using MSOL Powershell

Here we will take a look at a short script you can utilize in order to get the object ID of the Enterprise Application assuming you know the Application Registration Application ID. $tenantID = "" $appID = "" $msSP = Get-MsolServicePrincipal -AppPrincipalId $appID -TenantID $tenantID $objectId = $msSP.ObjectId

Using AAD V2.0 PowerShell

You can also utilize AAD powershell v2.0 using the command : $mysp = Get-AzureADServicePrincipal -searchstring $mysp.ObjectId

Now we have the service principal stored in the variable $mysp. We will use it later to associate a role to the enterprise application.

Using the Azure Portal

To get the ObjectID through the Azure Portal, you will need to go to portal.azure.com. From there go to Azure Active Directory on the left side bar. Then to Enterprise Applications > All Applications > (Your Enterprise Application to set to an Admin Role) > Properties > Object ID.

Assigning an Administrative Role for an Enterprise Application

First please make sure you have the Administrative Role Name on hand as you will need it in order to add the Admin Role to the Enterprise Application. You can find all the roles here: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles In this Example we will be using Helpdesk Administrator

Using MSOL to Add a Role Member

All we have to do is run the MSOL PowerShell cmdlet Add-MsolRoleMember. This PowerShell Cmdlet is described in detail here : https://docs.microsoft.com/en-us/powershell/module/msonline/add-msolrolemember?view=azureadps-1.0. For our intents and purposes, we can use this one liner in order to set the Enterprise Application to have the Admin Role : Add-MsolRoleMember -RoleName "Helpdesk Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $objectId Replacing ObjectID with the enterprise application’s ObjectID if you don't have $objectID saved. We have successfully added the admin role to the enterprise application. Note: This may require some time to take effect.

Using Azure AAD Powershell V2 to Add a Role Member

When using AAD PowerShell v2, you will need to get the object ID of the AAD role, you can utilize this command below to get the information. $myAADRole = Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq 'Helpdesk Administrator'} $myAADRole.ObjectId Now that we have the object IDs for the AAD role, we will need to get both object IDs to add the role to the enterprise application. We can use the command below : Add-AzureADDirectoryRoleMember -ObjectId $myAADRole.ObjectId -RefObjectId $mysp.ObjectId Replacing the variables with the object IDs if you don't have the variables saved. We have successfully added the admin role to the enterprise application. Note: This may require some time to take effect.

Conclusion

In this article we have gone over downloading MSOL and AAD V2.0, connecting with MSOL and V2.0, getting the object id for the enterprise application, getting the Application Role in MSOL and AAD V2.0, and giving the enterprise application the admin role using both AAD V2.0 and MSOL. you should now have an enterprise application that can do the actions that typically require a user with the admin privileges described in the role. If you have anymore issues feel free to open a support ticket or comment below and either one of our support engineers or I will try to assist you in this endeavor.

How to Create a New Schema Extension Using the Microsoft Graph Explorer

Frank Hu MSFT — Tue, 21 Aug 2018 02:17:13 GMT

Introduction

This post is to provide a tutorial on how to create a schema extension utilizing the Microsoft Graph Explorer. In this post we will, login to Microsoft Graph Explorer, create the V1 AAD Application, and make the Microsoft Graph Schema Extension call.

Getting the Access Token

Please navigate to the Microsoft Graph Explorer at : https://developer.microsoft.com/en-us/graph/graph-explorer Once the page loads, on the left, below authentication you will see the button that says sign in with Microsoft. Click this and go ahead and login. Login with an account that has the ability to modify AAD Application Schema Extensions. Now that you have logged in with an account, click on modify permissions underneath your name. From there find the permission required listed in the Create schemaExtension documentation. The permission is listed here : https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/schemaextension_post_schemaextensions If you need help finding permissions for APIs, please go through this article : https://blogs.msdn.microsoft.com/aaddevsup/2018/05/21/finding-the-correct-permissions-for-a-microsoft-or-azure-active-directory-graph-call/ This will help you when working with other Microsoft APIs that you need help finding permissions to. That being said, once you find the permission, click on the box next to it to check it. It will say that to change permissions you will need to login again. So when you press the modify permissions button, it will bring you back to the login page. From there, login and consent to the graph explorer application. Now, by logging in you should have an access token for the Graph Explorer to use. We can now press the run query button and get some information about ourselves, and have the correct permissions to make the call to the create Schema Extension Graph API.

Creating the AAD Application Registration

Now going back to the Azure portal, go to Azure Active Directory > App Registrations > New Application Registration From here you are now at the Create AAD Application Blade, fill out the name and sign-on URL with your own values. They won’t matter too much in this example. Now click on your new web app, and copy the Application ID.

Making the createSchemaExtensions Call

Now we have everything we need to make the create schema extensions call from the Microsoft Graph using the Graph Explorer. The nature of the createSchemaExtensions call is to add a schema extension to the application that is making the call. Since we are using the Graph Explorer, it will try to add it to the Graph Explorer’s AAD Application. You won’t be allowed to do this, as it is managed by Microsoft. So we have to set the Application ID of the application we would like to add the schema extension to in the body of our request. This is actually described in the documentation, although not very obvious, in the owner attribute for the request body.

owner String (Optional) The appId of the application that is the owner of the schema extension. This property can be supplied on creation, to set the owner. If not supplied, then the calling application's appId will be set as the owner. So, for example, if creating a new schema extension definition using Graph Explorer, you must supply the owner property. Once set, this property is read-only and cannot be changed.

I am going to copy the request from the documentation and put it into my request body, and then add the owner attribute with my application ID. You must also modify the ID, because if you wish to utilize the Domain_schema ID format, you must provide a domain that you own. So now my request looks like : { "id":"2cd76e65", "description": "Graph Learn training courses extensions", "owner" : "3f434c47-5229-40fc-be95-e6e1583ac4fc", "targetTypes": [ "Group" ], "properties": [ { "name": "courseId", "type": "Integer" }, { "name": "courseName", "type": "String" }, { "name": "courseType", "type": "String" } ] } In addition to that I also copied and pasted the request endpoint in the request example into the graph explorer URL box.(https://graph.microsoft.com/v1.0/schemaExtensions) I also then changed the blue box on the left of the URL box from GET to POST as we want to create the schema extension.

Conclusion

In this post we have gone through, logging in, getting the right permissions, modifying the request body example for your application, and then adding the schema extension to your application. For more information on the schema extension please go through the schema extension attribute documentation here : https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/resources/schemaextension You will see the different resource types and other information that you can use to create your Schema Extension. If you have any issues, feel free to open a support ticket and one of our support engineers will reach out to you as soon as possible to resolve the issue. Also feel free to comment below and I will try to reach out to you to resolve the issue.